Related features:

Related Powershell Guides:

How to assign fine-grained password policies to users or groups in AD

Assigning fine-grained password policies to users or groups in AD

IT admins are often tasked with applying fine-grained password policies in AD to enforce different password requirements for various users or groups based on their security needs, roles, or departments. This can be accomplished through several methods: the native Active Directory Administrative Center (ADAC), PowerShell, or self-service password management solutions like ManageEngine ADSelfService Plus. Let's explore these different approaches below.

Assigning fine-grained password policies to users or groups in AD using ADAC

  1. Open ADAC on your domain controller or management workstation.
  2. Select your domain and navigate to System > Password Settings Container.
  3. Locate and right-click the existing fine-grained password policy you want to assign.
  4. Select Properties from the context menu.
  5. In the Properties window, scroll down to the Directly Applies To section.
  6. Click Add to assign users or groups to this policy.
  7. In the Select Users or Groups dialog box:
    • Enter the names of users, groups, or OUs to search for.
    • Click Check Names to validate your entries.
    • Select the desired users or groups from the search results.
  8. Click OK to add the selected users or groups to the policy.
    9. The Select Users or Groups dialog box for assigning a fine-grained password policy in AD.
  9. Verify that the users and groups are now listed in the Directly Applies To section.
  10. Click OK to save the changes and apply the policy assignment.
    11. ADAC's Directly Applies To section that shows if the selected password policy is applied to the desired users or groups.

Assigning fine-grained password policies to users or groups in AD using PowerShell

Prerequisites

Before using the Add-ADFineGrainedPasswordPolicySubject cmdlet, please verify that the following prerequisites are satisfied:

  • Ensure the AD PowerShell module is installed. If not, install it using Server Manager or enable it through Windows Features.
  • For Windows 10 or 11 workstations, install Remote Server Administration Tools.
  • Ensure you have the necessary permissions in AD to manage fine-grained password policies (this requires Domain Admin or delegated permissions for the Password Settings Container).

Add ADFineGrainedPasswordPolicySubject to assign fine-grained password policies to users or groups in AD

The Add-ADFineGrainedPasswordPolicySubject cmdlet can be used in PowerShell to assign an existing fine-grained password policy to users or groups in AD. The syntax for it is given below:

Add-ADFineGrainedPasswordPolicySubject
[-WhatIf]
[-Confirm]
[-AuthType <ADAuthType>]
[-Credential <PSCredential>]
[-Identity] <ADFineGrainedPasswordPolicy>
[-Partition <String>]
[-PassThru]
[-Server <String>]
[-Subjects] <ADPrincipal[]>
[<CommonParameters>]

Supported parameters

The following table contains some parameters that can be used along with the Add-ADFineGrainedPasswordPolicySubject cmdlet to assign fine-grained password policies to users or groups in AD efficiently.

Parameter Description
-Identity This specifies the fine-grained password policy to be assigned. You can identify the policy using its distinguished name, globally unique identifier (GUID), security identifier (SID), or policy name.
-Subjects This specifies one or more users or groups that will receive this password policy. It accepts user or group distinguished names, GUIDs, SIDs , or Security Account Manager (SAM) account names. You can provide multiple subjects as a comma-separated array.
-AuthType This defines the authentication method for connecting to AD. The valid options are Negotiate (the default, which uses Kerberos or NTLM) or Basic (basic authentication, which requires SSL). Most environments use the default Negotiate.
-Credential This provides alternate credentials for running the cmdlet if you need to use a different account than the one currently logged in. Use the Get-Credential command to create a PSCredential object, which is useful when running the cmdlet from a workstation or with a non-admin account.
-PassThru This returns the fine-grained password policy object after the assignment is complete, showing you what was modified. Without this parameter, the cmdlet runs silently with no output.
-Server This specifies which domain controller to connect to for executing this command. It can be a fully qualified domain name, Network Basic Input/Output System name, or IP address. If no server is specified, the cmdlet uses the default domain controller.
-WhatIf This performs a simulation showing what would happen if the command were to run, without making any actual changes. This is useful for verifying your command before applying it to the production environment.
-Confirm This prompts you for confirmation before executing the command, adding an extra safety check before making changes to your password policy assignments.

Use cases: Add ADFineGrainedPasswordPolicySubject

Assigning a fine-grained password policy to a security group

To assign a fine-grained password policy to a security group, use the following cmdlet:

Add-ADFineGrainedPasswordPolicySubject -Identity <'policy_name'> -Subjects <'group_name'>

For this cmdlet, replace policy_name with the name or distinguished name of your fine-grained password policy and replace group_name with the security group that should receive this policy.

Bulk assignment of a fine-grained password policy using PowerShell

To assign a single password policy to multiple users and groups simultaneously, use the following cmdlet:

# Define the policy to be assigned
$PolicyName = <'policy_name'>
# Define multiple users and groups that need this policy
$Subjects = @(
<'subject_1'>,
<'subject_2'>,
<'subject_3'>,
<'subject_4'>,
<'subject_5'>
)
# Apply the policy to all subjects at once
Add-ADFineGrainedPasswordPolicySubject -Identity $PolicyName -Subjects $Subjects
Write-Host "Successfully assigned $PolicyName to $($Subjects.Count) users and groups" -ForegroundColor Green

For this cmdlet, replace policy_name with the name of your fine-grained password policy and replace subject_1 through subject_5 with the distinguished names, SAM account names, or group names that should receive this policy.

Assigning different policies to different groups based on organizational requirements

To assign different policies to different groups based on organizational requirements, use the following cmdlet:

# Define department-to-policy mappings
$PolicyAssignments = @(
@{Policy=<'policy_1'>; Group=<'group_1'>},
@{Policy=<'policy_2'>; Group=<'group_2'>},
@{Policy=<'policy_3'>; Group=<'group_3'>},
@{Policy=<'policy_4'>; Group=<'group_4'>}
)
# Loop through each assignment and apply the policies
foreach ($Assignment in $PolicyAssignments) {
try {
Add-ADFineGrainedPasswordPolicySubject `
-Identity $Assignment.Policy `
-Subjects $Assignment.Group
Write-Host "Successfully assigned $($Assignment.Policy) to $($Assignment.Group)" -ForegroundColor Green }
catch {
Write-Host "Failed to assign $($Assignment.Policy) to $($Assignment.Group): $_" -ForegroundColor Red }
}

For this cmdlet, replace policy_1 through policy_4 with your fine-grained password policy names and replace group_1 through group_4 with the corresponding groups or users that should receive each policy.

Assigning fine-grained password policies to users or groups in AD using ADSelfService Plus

  1. Log in to ADSelfService Plus and navigate to Configuration > Self-Service > Policy Configuration.
  2. Click the Edit icon next to your desired policy, select the OUs and groups by using the Select OUs/Groups option, and click Save Policy.
    3. ADSelfService Plus' Policy Configuration page for selecting OUs and groups to apply password policies to.
  3. Navigate to Self-Service > Password Policy Enforcer.
  4. Enable Enforce Custom Password Policy, select the policy from the drop-down menu, and click Save.
    5. ADSelfService Plus' Password Policy Enforcer page for enabling a custom password policy for the selected OUs and groups.

Stay informed about password policy compliance and violations

ADSelfService Plus' Password Policy Enforcer helps ensure password compliance throughout your organization by enforcing custom password policies during self-service password resets and changes, preventing weak passwords, and maintaining consistent security standards across your AD environment.

  • Custom password policy enforcement

    Unburden users from lengthy help desk calls by empowering them with self-service password reset and account unlock capabilities.

  • Policy synchronization across platforms

    Ensure password policies remain consistent across AD, Entra ID, and other connected platforms with centralized policy management and enforcement.

  • Dictionary-based password prevention

    Prevent users from choosing weak passwords by implementing custom dictionary checks that block commonly used passwords, breached passwords, and organization-specific terms during password resets.

  • Password expiration tracking

    View upcoming password expirations and send proactive notifications to users before their passwords expire, reducing help desk tickets from locked-out users.

  • Pattern and complexity validation

    Configure advanced pattern checks to prevent predictable passwords, like those with keyboard patterns, repeated characters, or sequential numbers, during self-service password resets.

  • Granular policy application

    Apply different password policies to different OUs and groups based on user roles, departments, or security requirements using ADSelfService Plus' flexible policy configuration.

Important tips

  • Enable MFA for users with less restrictive password policies to maintain security through additional verification methods.
  • Implement self-service account unlocks to reduce help desk tickets when users get locked out due to forgotten passwords.
  • Automate user enrollment in self-service password management to ensure all users subject to fine-grained password policies can reset passwords without help desk intervention.

Assign fine-grained password policies to users and groups effortlessly with ADSelfService Plus

Try it now for free
 
  • Assigning fine-grained password policies to users or groups in AD
  • Assigning fine-grained password policies to users or groups in AD using ADAC
  • Assigning fine-grained password policies to users or groups in AD using PowerShell
  • Add ADFineGrainedPasswordPolicySubject to assign fine-grained password policies to users or groups in AD
  • Supported parameters
  • Use cases: Add ADFineGrainedPasswordPolicySubject
  • Assigning fine-grained password policies to users or groups in AD using ADSelfService Plus
  • Stay informed about password policy compliance and violations
  • Important tips

ADSelfService Plus trusted by

A single pane of glass for complete self service password management
Password Self-ServiceDirectory Self-ServiceOne IdentitySecurityRelated Products

A single pane of glass for complete self service password management

Free Trial Get Quote
Email Download Link